meta-mask[.]xyz

Analysis of the domain meta-mask.xyz indicates high-risk brand impersonation targeting MetaMask users. Registered on May 20, 2026, through GMO Internet Group, Inc. d/b/a Onamae.com, the domain currently resolves to IP address 13.248.169.48, hosted on AWS Global Accelerator infrastructure in Canada. The SSL certificate, issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, does not mitigate the threat posed by this active phishing site. Infrastructure review reveals the domain uses nameservers ns5.afternic.com and ns6.afternic.com, alongside a verification-specific nameserver (verification-gakbzzzqmt6gkcplw4efpp.ns). This configuration, combined with a 200 HTTP status response, suggests the site remains operational and accessible. Threat intelligence platforms confirm its malicious classification: the domain appears in two AlienVault OTX pulses and is blocked by two security vendors, including MetaMask's own protective measures. VirusTotal scans report 12 of 91 security vendors flagging meta-mask.xyz as malicious, though the absence of additional context limits attribution to specific attack vectors or payloads. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. No evidence currently links this domain to a known phishing kit or broader campaign infrastructure. Defenders should treat meta-mask.xyz as an active threat. Immediate actions include blocking the domain and its resolving IP at perimeter security controls, alerting users to the impersonation risk, and monitoring for related indicators of compromise. Given the domain's recent registration and persistent activity, continued vigilance is warranted until takedown or further analysis provides additional clarity.